seo-technical

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed SEO audit guide, with one optional command that should be pinned before use.

Before installing or using this skill, confirm you trust the seogeo tooling and any configured SEO APIs, run audits only for authorized sites, and prefer a pinned Lighthouse version or a preinstalled trusted binary instead of npx lighthouse@latest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/agent-friendly-pages.md:126

Finding

Unpinned Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: references/agent-friendly-pages.md:126
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable code:

bash

CLI `npx lighthouse@latest <url> --only-categories=agentic-browsing` (per-audit

Technical Analysis

The documented command directs npx to resolve and execute Lighthouse using the mutable latest distribution tag. If the package is not already available locally, npx may retrieve executable package content from the configured npm registry.

Because neither an exact version nor an integrity-protected lockfile is specified, the effective code can change after the Skill has been reviewed. A compromised npm publisher account, malicious package release, registry compromise, or compromised transitive dependency could therefore introduce arbitrary code into the command's execution path.

This is classified as T08: Insecure Dependencies because the primary weakness is unsafe, unpinned dependency acquisition. The reviewed instruction does not itself identify a malicious package or deliberately retrieve a known malicious payload.

Attack Path

1. An attacker compromises the Lighthouse publishing account, package supply chain, registry resolution path, or a dependency included by a future release.
2. The attacker publishes malicious code in a release selected by the latest tag.
3. A user or agent follows the Skill's documented command.
4. npx resolves the mutable tag and downloads the affected package when it is not safely available locally.
5. The package executes under the invoking process's operating-system identity.
6. The malicious code can access resources available to that identity and perform further local or network operations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or agent running npx. The potential scope includes rea ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

• Replace lighthouse@latest with an exact, reviewed version, for example lighthouse@13.4.0, after independently verifying that version.
• Install dependencies in a separate controlled step using a committed lockfile and integrity verification.
• Prefer a preinstalled, trusted Lighthouse binary in automated environments.
• Use npx --no-install lighthouse ... after controlled installation to prevent implicit network retrieval during the audit.
• Apply dependency scanning and periodically review pinned upgrades before changing the approved version.
• Run the audit tool in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained outbound networking.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.